Legrand BTicino Driver Manager F454 1.0.51 Authenticated Stored XSS Exploit

Summary Audio/video web server for the remote control of the system using web pages or the MY HOME portal. The device can operate as a gateway for the use of the MHVisual and Virtual Configurator software - 6 DIN modules. It replaces item F453 and F453AV. Description The application suffers from ...

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting

!-- CS...

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery Cross-Site Scripting

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery Cross-Site Scripting input type="hidden" name="password2" value="newpass123" /...

Legrand BTicino Driver Manager F454 1.0.51 Cross Site Request Forgery

!-- CSRF PoC OpenWebN...

CVE-2018-16624

panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page...

Cross site scripting

panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page...

CVE-2018-16624

Kirby CMS – Kirby v2.5.12 is affected. The vulnerability is in panel/pages/home/edit where an XSS flaw can be triggered by the title of a newly created page. The available connected documents confirm the component/file (panel/pages/home/edit) and the impact (XSS). No explicit root cause or exploi...

DEBIAN-CVE-2019-5429

Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory...

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

In kubectl v1.8.0+, schema info is cached in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be...

Vulnerabilities in the WPA3 Wi-Fi Security Protocol

Researchers have found several vulnerabilities in the WPA3 Wi-Fi security protocol: The design flaws we discovered can be divided in two categories. The first category consists of downgrade attacks against WPA3-capable devices, and the second category consists of weaknesses in the Dragonfly...

The vulnerability of the Cisco Smart Call Home component for Cisco IOS XE and Cisco IOS operating systems allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Cisco Smart Call Home component for Cisco IOS XE and Cisco IOS exists due to insufficient verification of certificate authenticity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information...

How To Make Your Amazon Echo and Google Home as Private as Possible

With news that Amazon lets human employees listen to Alexa recordings, you might want to tighten up your smart assistant ship...

Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an...

Code injection

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries aka nnabla through v1.0.14 relies on the HOME environment variable, which might be untrusted...

CVE-2019-10844

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries aka nnabla through v1.0.14 relies on the HOME environment variable, which might be untrusted...

PYSEC-2019-107

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries aka nnabla through v1.0.14 relies on the HOME environment variable, which might be untrusted...

CVE-2019-10844

CVE-2019-10844 affects Sony Neural Network Libraries (nnabla) – nbla/logger.cpp in libnnabla.a up to v1.0.14. The root cause is that code relies on the HOME environment variable, which is untrusted, enabling potential influence on behavior via the user’s HOME value. Public references in Red Hat a...

Sony Neural Network Libraries Input Validation Error Vulnerability

Neural Network Libraries is a deep learning framework designed for research, development and production. An input validation error vulnerability exists in nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries nnabla 1.0.14 and earlier. The vulnerability stems from the software's...

SUSE SLED12 / SLES12 Security Update : Recommended update for adcli, sssd (SUSE-SU-2019:0805-1)

This update for adcli and sssd provides the following improvement : Security vulnerability fixed : CVE-2019-3811: Fix fallbackhomedir returning '/' for empty home directories bsc1121759 Other fixes: Add an option to disable checking for trusted domains in the subdomains provider bsc1125617 Clear...

BSA-2018-606

Security Advisory ID : BSA-2018-606 Component : bzip2recover Revision : 2.0 The GNU C Library aka glibc or libc6 before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the operator follow...